so why do i pay for cell phone service? you're saying most people can just point some metal out of their window and the neighborhood would be happy?
> you're saying most people can just point some metal out of their window and the neighborhood would be happy
Technically? Yes, you can do it in a few hours, or as a weekend project if you’ve never done it before. Just grab a full-duplex SDR; you don’t need to go for expensive ones like the USRP. Get a BladeRF or LimeSDR, download the software, and set up the station. The problem lies with the regulations. Depending on where you live, you might face hefty charges for violating spectrum rules, and they are actively looking for such violations by the way. One of the proofs of concept we did with the regulators here in Canada involves using a drone to detect these violations. It’s just a matter of time before they find you.
The other trick was how more things are designed to stay on even when they look off. An older one with older phones would make it answer silently so you didn’t know if they were listening.
There’s so many risks with telecoms that high-assurance security (a) said keep cell phones away from anything security-critical and (b) used Red-Black separation where whatever connects to untrusted line never had any plaintext, just encrypted. Seperation kernels, like INTEGRITY-178B and seL4, were invented to hopefully do that with software.
For law enforcement they have multiple levels of collecting location data. Of course, your location is sent to Google or Apple etc as you move around. Even your searches for destinations in stuff like Google Maps, even incognito in Google Maps, reports your search, live, to law enforcement if they request it. Often with sketchy legal justifications to the third party.
If a target is moving around a city, they can be followed live on the array of cameras everywhere, accessible remotely. Many with facial recognition. Others in populated areas collecting all kinds of information. Wifi broadcasts, bluetooth devices, any RFID, all collected, stored and combined. This is how they are able to use a form of geo fencing requests to find out who was in an area at a specific time, potentially interacting with the target.
Networks of interactions at a global scale get revealed this way.
It just goes on and on too. Go to a rural area and maybe everyone has front door cameras. LE can access them remotely.
In fact, your entire ISP connection can be man in the middle decrypted and parts overwritten in transit, if given access at the ISP level.
While working in iCloud typing notes or watching YouTube videos, they can control your live sessions, watch you compose a document... Choose which videos you are recommended. Choose the advertisements you see.
The possibilities for them really are endless and all of this happens in many cases. It is a surveillence state.
True and sad. The only thing keeping LE from using those means is the lack of equipment, lack of knowledge and burocracy.
Kernel up used to be the most, targeted layers. I’ve been out of the field a few years. I don’t know how many black hats use 0-days on basebands in practice.
As for reliability, well, that's your problem now, good luck!
> point some metal out of their window and the neighborhood would be happy?
You might, but the FCC won't